What is the AVG?
The AVG (Algemene Verordening Gegevensbescherming) is the European privacy law, Regulation (EU) 2016/679, that sets the conditions under which organisations may collect, use, retain and protect personal data. AVG is simply the Dutch name for the GDPR (General Data Protection Regulation): one regulation that applies directly in every EU member state. The AVG has applied since 25 May 2018 and replaced the Dutch Personal Data Protection Act (Wbp). National choices, such as rules on the BSN citizen service number and biometrics, are set out in the Dutch GDPR Implementation Act (UAVG).
The AVG governs how organisations may collect, use, retain and protect personal data, with the goal of protecting people’s privacy and other fundamental rights.
🎯 Why is the AVG important?
- Accountability - you must not only comply, but also be able to demonstrate compliance (Article 5(2))
- Data subject rights - including access, rectification, erasure, restriction, portability and objection
- Duty of security - appropriate technical and organisational measures based on a risk assessment (Article 32)
- Breach notification - to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and, in serious cases, to the people affected
- Substantial fines - up to €20 million or 4% of worldwide annual turnover, whichever is higher
🔍 What counts as personal data?
Under Article 4 of the AVG, personal data is any information relating to an identified or identifiable natural person, directly or indirectly. Examples:
- Name, email address, IP address, photograph and staff number
- Location data, BSN and the number plates of company vehicles
- HR records, camera footage, access logs and login credentials
In its 2016 Breyer judgment, the Court of Justice of the EU ruled that even a dynamic IP address can be personal data. Special categories of personal data (Article 9), such as health data and biometric data used for unique identification, may in principle not be processed unless a legal exception applies. Under Article 46 of the UAVG, the BSN may only be used where a law requires it, for example in payroll administration.
🧭 What are the principles of the AVG?
Article 5 lists seven principles that apply to every processing operation:
| Principle | Explanation |
|---|---|
| Lawfulness, fairness and transparency | There is a valid legal basis and data subjects know what happens |
| Purpose limitation | Use data only for a specified, explicit purpose defined in advance |
| Data minimisation | Collect no more than is necessary |
| Accuracy | Data is correct and corrected where needed |
| Storage limitation | Keep data no longer than the purpose requires |
| Integrity and confidentiality | Appropriate protection against loss, theft and misuse |
| Accountability | You must be able to demonstrate compliance with the AVG |
Every processing operation also needs one of the six legal bases in Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent is rarely valid in an employment relationship, because an employee cannot freely refuse.
🏭 Where does the AVG touch OT environments?
OT systems control machines, but they process personal data more often than many organisations realise:
- Operator accounts and audit trails - an HMI, SCADA system or MES records who changed which setpoint; those logs can be traced to individuals
- Production data per employee - a historian that tracks output per operator or shift makes performance monitoring possible
- Access control and cameras - badge systems, building automation and CCTV record presence and behaviour
- Biometrics - fingerprint or facial recognition for access or time registration
- Location and telematics - tracking of forklifts, vehicles and wearables on site
- Remote maintenance - suppliers with remote access may be able to see personal data and then usually act as processors
Under Article 29 of the UAVG, biometrics are only permitted where necessary for authentication or security purposes, or with explicit consent. In April 2020 the AP announced a €725,000 fine on a company for requiring employees to clock in and out with their fingerprint. Under the AP’s guideline, you keep camera footage for no more than four weeks, unless a specific incident is being dealt with.
🔐 Which technical measures does the AVG require?
Article 32 explicitly names pseudonymisation and encryption, availability and resilience of systems, timely restoration after an incident and regular testing of measures. In practice this aligns with existing cybersecurity controls:
- Encryption (encryption) of data at rest and in transit
- Access management, least privilege and MFA for administrator accounts
- Network segmentation so that personal data cannot leak unnoticed from the production network
- Logging and SIEM to detect and investigate data breaches
- Backups and an Incident Response Plan for recovery and notification
- Privacy by Design (Article 25): building privacy in from the design stage, for example by pseudonymising operator names in reports
An ISO 27001 management system or, for Dutch government bodies, the BIO provides a structure for embedding these measures in a demonstrable way.
🛑 What should you do after a data breach?
A personal data breach is a security incident that leads to the destruction, loss, alteration or unauthorised disclosure of, or access to, personal data; a ransomware attack or a misdirected email can also be a data breach.
- Notify the AP - without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk (Article 33)
- Inform the people affected - only where the breach is likely to result in a high risk; this is not required if, for example, the data was properly encrypted (Article 34)
- Document - record every breach in an internal register, even when no notification is required
If your organisation falls under NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026), a single incident may require two notifications. The Cbw reporting obligation (early warning within 24 hours, notification within 72 hours) goes to the CSIRT, while the AVG notification goes separately to the AP.
🧾 Which obligations apply under the AVG?
| Obligation | For whom? | Article |
|---|---|---|
| Maintain a record of processing activities | All organisations; the exemption below 250 employees lapses for risky, regular or special-category processing | 30 |
| Conclude a data processing agreement | When outsourcing to, for example, a cloud or maintenance provider | 28 |
| Notify and record data breaches | All controllers | 33–34 |
| Carry out a DPIA | Where a high risk is likely, such as employee monitoring, location data or biometrics | 35 |
| Appoint a DPO (Data Protection Officer) | Public bodies, large-scale systematic monitoring or large-scale special-category data | 37 |
| Handle data subject requests | All controllers, within one month (extendable by two months where necessary) | 12–22 |
🛠️ How do you approach the AVG in an IT/OT environment?
- Inventory - map for each system (HMI, MES, historian, access control, cameras) which personal data it processes, and add it to the record of processing activities
- Define purpose and legal basis - usually legitimate interests or a legal obligation, with a documented balancing test
- Carry out a DPIA - the AP publishes a list of 17 types of processing that require a DPIA, including employee monitoring
- Involve the works council - under Article 27 of the Dutch Works Councils Act (WOR), the works council has a right of consent for systems capable of monitoring presence, behaviour or performance
- Set retention periods - for example four weeks for camera footage and a fixed period for operator logs
- Manage suppliers - data processing agreements and requirements through supplier security
- Rehearse the notification procedure - one playbook for both AVG and Cbw notifications
⚖️ How high are AVG fines in the Netherlands?
| Tier | Maximum | Examples of infringements |
|---|---|---|
| Lower (Art. 83(4)) | €10 million or 2% of worldwide annual turnover | Inadequate security, failure to report a breach, no DPIA |
| Higher (Art. 83(5)) | €20 million or 4% of worldwide annual turnover | No legal basis, breach of principles or rights, unlawful transfers |
The AP’s highest fine up to that point came in August 2024: €290 million on Uber, for transferring drivers’ data to the United States without adequate safeguards. In September 2024 it followed with €30.5 million for Clearview AI over an illegal facial recognition database.
❓ Frequently asked questions
What is the difference between the AVG and the GDPR?
The AVG and the GDPR are the same European regulation: AVG is the Dutch name and GDPR the English one. Dutch additions to the AVG, such as rules on the BSN and biometrics, are set out in the Dutch GDPR Implementation Act (UAVG).
Does the AVG apply to OT systems?
The AVG applies to every system that processes personal data, so OT systems are included. Operator logins, audit trails in an HMI or MES, camera footage and access logs can be traced to individuals and therefore fall under the AVG.
How quickly must you report a data breach?
Under the AVG you report a data breach to the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of discovering it. You only inform the people affected when the breach is likely to result in a high risk to them.
May an employer use fingerprints for access control?
Under the AVG and Article 29 of the UAVG, an employer may only use fingerprints where this is necessary for authentication or security, for example to access a high-security area. Ordinary time registration does not meet that test; in 2020 the Dutch regulator announced a €725,000 fine for it.
Is a DPIA required for camera surveillance in a factory?
Under the AVG a DPIA is required when camera surveillance monitors employees on a large scale or systematically, or when it is used covertly. A single camera at an entrance gate usually does not require a DPIA, but documenting the assessment is still sensible.
How does the AVG relate to NIS2 and the Dutch Cybersecurity Act?
The AVG protects personal data, whereas NIS2 and the Dutch Cybersecurity Act protect the continuity of essential and important services. A single cyber incident can fall under both regimes and then require both an AVG notification to the AP and a Cbw notification to the CSIRT.
📌 In summary
The AVG has applied since 25 May 2018 to every organisation that processes personal data, including in production environments. Seven principles, six legal bases and a duty of security form its core, supplemented by breach notification, DPIAs and data subject rights. In OT the main concerns are operator logs, camera footage, access control, biometrics and location data.
The AVG is the European privacy law that governs how you handle personal data responsibly and securely, and it applies just as much to the HMI log and the entrance gate as to the customer database.